News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by peteatphylum on Wednesday November 02, 2022 @04:48PM (#33442699)
We've found a lot of open-source packages that are authored by (well, released by authors identified by) disposable email addresses. We were shocked to find companies doing this, too.

Package Dependency land is a crazy place

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by remram on Wednesday November 02, 2022 @04:52PM (#33442757)
The reason is obvious, people crawl pypi.org/github.com/npmjs.com and email their job posts or product launches. Every platform that requires an email and shows it publicly will necessarily get a lot of disposable ones.
[ Parent | on HN ]